@budibase/worker 2.3.20 → 2.3.21-alpha.0

package/src/sdk/auth/auth.ts

@@ -0,0 +1,86 @@
+import {
+  auth as authCore,
+  tenancy,
+  utils as coreUtils,
+  sessions,
+  events,
+  HTTPError,
+} from "@budibase/backend-core"
+import { PlatformLogoutOpts, User } from "@budibase/types"
+import jwt from "jsonwebtoken"
+import env from "../../environment"
+import * as userSdk from "../users"
+import * as emails from "../../utilities/email"
+import * as redis from "../../utilities/redis"
+import { EmailTemplatePurpose } from "../../constants"
+
+// LOGIN / LOGOUT
+
+export async function loginUser(user: User) {
+  const sessionId = coreUtils.newid()
+  const tenantId = tenancy.getTenantId()
+  await sessions.createASession(user._id!, { sessionId, tenantId })
+  const token = jwt.sign(
+    {
+      userId: user._id,
+      sessionId,
+      tenantId,
+    },
+    env.JWT_SECRET!
+  )
+  return token
+}
+
+export async function logout(opts: PlatformLogoutOpts) {
+  // TODO: This should be moved out of core and into worker only
+  // account-portal can call worker endpoint
+  return authCore.platformLogout(opts)
+}
+
+// PASSWORD MANAGEMENT
+
+/**
+ * Reset the user password, used as part of a forgotten password flow.
+ */
+export const reset = async (email: string) => {
+  const configured = await emails.isEmailConfigured()
+  if (!configured) {
+    throw new HTTPError(
+      "Please contact your platform administrator, SMTP is not configured.",
+      400
+    )
+  }
+
+  const user = await userSdk.core.getGlobalUserByEmail(email)
+  // exit if user doesn't exist
+  if (!user) {
+    return
+  }
+
+  // exit if user has sso
+  if (await userSdk.isPreventPasswordActions(user)) {
+    return
+  }
+
+  // send password reset
+  await emails.sendEmail(email, EmailTemplatePurpose.PASSWORD_RECOVERY, {
+    user,
+    subject: "{{ company }} platform password reset",
+  })
+  await events.user.passwordResetRequested(user)
+}
+
+/**
+ * Perform the user password update if the provided reset code is valid.
+ */
+export const resetUpdate = async (resetCode: string, password: string) => {
+  const { userId } = await redis.checkResetPasswordCode(resetCode)
+
+  let user = await userSdk.getUser(userId)
+  user.password = password
+  user = await userSdk.save(user)
+
+  // remove password from the user before sending events
+  delete user.password
+  await events.user.passwordReset(user)
+}

package/src/sdk/auth/index.ts

@@ -0,0 +1 @@
+export * from "./auth"

package/src/sdk/tenants/index.ts

@@ -0,0 +1 @@
+export * from "./tenants"

package/src/sdk/tenants/tenants.ts

@@ -0,0 +1,76 @@
+import { App } from "@budibase/types"
+import { tenancy, db as dbCore, platform } from "@budibase/backend-core"
+import { quotas } from "@budibase/pro"
+
+export async function deleteTenant(tenantId: string) {
+  await quotas.bustCache()
+  await platform.tenants.removeTenant(tenantId)
+  await removeTenantUsers(tenantId)
+  await removeTenantApps(tenantId)
+  await removeGlobalDB(tenantId)
+}
+
+async function removeGlobalDB(tenantId: string) {
+  try {
+    const db = tenancy.getTenantDB(tenantId)
+    await db.destroy()
+  } catch (err) {
+    console.error(`Error removing tenant ${tenantId} users from info db`, err)
+    throw err
+  }
+}
+
+async function removeTenantApps(tenantId: string) {
+  try {
+    const apps = (await dbCore.getAllApps({ all: true })) as App[]
+    const destroyPromises = apps.map(app => {
+      const db = dbCore.getDB(app.appId)
+      return db.destroy()
+    })
+    await Promise.allSettled(destroyPromises)
+  } catch (err) {
+    console.error(`Error removing tenant ${tenantId} apps`, err)
+    throw err
+  }
+}
+
+function getTenantUsers(tenantId: string) {
+  const db = tenancy.getTenantDB(tenantId)
+
+  return db.allDocs(
+    dbCore.getGlobalUserParams(null, {
+      include_docs: true,
+    })
+  )
+}
+
+async function removeTenantUsers(tenantId: string) {
+  try {
+    const allUsers = await getTenantUsers(tenantId)
+    const allEmails = allUsers.rows.map((row: any) => row.doc.email)
+
+    // get the id and email doc ids
+    let keys = allUsers.rows.map((row: any) => row.id)
+    keys = keys.concat(allEmails)
+
+    const platformDb = platform.getPlatformDB()
+
+    // retrieve the docs
+    const userDocs = await platformDb.allDocs({
+      keys,
+      include_docs: true,
+    })
+
+    // delete the docs
+    const toDelete = userDocs.rows.map((row: any) => {
+      return {
+        ...row.doc,
+        _deleted: true,
+      }
+    })
+    await platformDb.bulkDocs(toDelete)
+  } catch (err) {
+    console.error(`Error removing tenant ${tenantId} users from info db`, err)
+    throw err
+  }
+}

package/src/sdk/users/events.ts

@@ -84,6 +84,10 @@ export const handleSaveEvents = async (
     ) {
       await events.user.passwordForceReset(user)
     }
+
+    if (user.password !== existingUser.password) {
+      await events.user.passwordUpdated(user)
+    }
   } else {
     await events.user.created(user)
   }

package/src/sdk/users/index.ts

@@ -1 +1,2 @@
 export * from "./users"
+export { users as core } from "@budibase/backend-core"

package/src/sdk/users/tests/users.spec.ts

@@ -0,0 +1,76 @@
+import { structures } from "../../../tests"
+import { mocks } from "@budibase/backend-core/tests"
+import { env } from "@budibase/backend-core"
+import * as users from "../users"
+import { CloudAccount } from "@budibase/types"
+import { isPreventPasswordActions } from "../users"
+
+jest.mock("@budibase/pro")
+import * as _pro from "@budibase/pro"
+const pro = jest.mocked(_pro, true)
+
+describe("users", () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+  })
+
+  describe("isPreventPasswordActions", () => {
+    it("returns false for non sso user", async () => {
+      const user = structures.users.user()
+      const result = await users.isPreventPasswordActions(user)
+      expect(result).toBe(false)
+    })
+
+    it("returns true for sso account user", async () => {
+      const user = structures.users.user()
+      mocks.accounts.getAccount.mockReturnValue(
+        Promise.resolve(structures.accounts.ssoAccount() as CloudAccount)
+      )
+      const result = await users.isPreventPasswordActions(user)
+      expect(result).toBe(true)
+    })
+
+    it("returns true for sso user", async () => {
+      const user = structures.users.ssoUser()
+      const result = await users.isPreventPasswordActions(user)
+      expect(result).toBe(true)
+    })
+
+    describe("enforced sso", () => {
+      it("returns true for all users when sso is enforced", async () => {
+        const user = structures.users.user()
+        pro.features.isSSOEnforced.mockReturnValue(Promise.resolve(true))
+        const result = await users.isPreventPasswordActions(user)
+        expect(result).toBe(true)
+      })
+    })
+
+    describe("sso maintenance mode", () => {
+      beforeEach(() => {
+        env._set("ENABLE_SSO_MAINTENANCE_MODE", true)
+      })
+
+      afterEach(() => {
+        env._set("ENABLE_SSO_MAINTENANCE_MODE", false)
+      })
+
+      describe("non-admin user", () => {
+        it("returns true", async () => {
+          const user = structures.users.ssoUser()
+          const result = await users.isPreventPasswordActions(user)
+          expect(result).toBe(true)
+        })
+      })
+
+      describe("admin user", () => {
+        it("returns false", async () => {
+          const user = structures.users.ssoUser({
+            user: structures.users.adminUser(),
+          })
+          const result = await users.isPreventPasswordActions(user)
+          expect(result).toBe(false)
+        })
+      })
+    })
+  })
+})

package/src/sdk/users/users.ts

@@ -6,36 +6,37 @@ import {
   cache,
   constants,
   db as dbUtils,
-  deprovisioning,
   events,
   HTTPError,
-  migrations,
   sessions,
   tenancy,
+  platform,
   users as usersCore,
   utils,
   ViewName,
+  env as coreEnv,
 } from "@budibase/backend-core"
 import {
   AccountMetadata,
   AllDocsResponse,
   BulkUserResponse,
   CloudAccount,
-  CreateUserResponse,
   InviteUsersRequest,
   InviteUsersResponse,
-  MigrationType,
+  isSSOAccount,
+  isSSOUser,
   PlatformUser,
   PlatformUserByEmail,
   RowResponse,
   SearchUsersRequest,
+  UpdateSelf,
   User,
-  ThirdPartyUser,
-  isUser,
+  SaveUserOpts,
 } from "@budibase/types"
 import { sendEmail } from "../../utilities/email"
 import { EmailTemplatePurpose } from "../../constants"
-import { groups as groupsSdk } from "@budibase/pro"
+import * as pro from "@budibase/pro"
+import * as accountSdk from "../accounts"
 
 const PAGE_LIMIT = 8
 
@@ -56,11 +57,22 @@ export const countUsersByApp = async (appId: string) => {
   }
 }
 
+export const getUsersByAppAccess = async (appId?: string) => {
+  const opts: any = {
+    include_docs: true,
+    limit: 50,
+  }
+  let response: User[] = await usersCore.searchGlobalUsersByAppAccess(
+    appId,
+    opts
+  )
+  return response
+}
+
 export const paginatedUsers = async ({
   page,
   email,
   appId,
-  userIds,
 }: SearchUsersRequest = {}) => {
   const db = tenancy.getGlobalDB()
   // get one extra document, to have the next page
@@ -94,26 +106,23 @@ export const paginatedUsers = async ({
   })
 }
 
+export async function getUserByEmail(email: string) {
+  return usersCore.getGlobalUserByEmail(email)
+}
+
 /**
  * Gets a user by ID from the global database, based on the current tenancy.
  */
 export const getUser = async (userId: string) => {
-  const db = tenancy.getGlobalDB()
-  let user = await db.get(userId)
+  const user = await usersCore.getById(userId)
   if (user) {
     delete user.password
   }
   return user
 }
 
-export interface SaveUserOpts {
-  hashPassword?: boolean
-  requirePassword?: boolean
-  currentUserId?: string
-}
-
 const buildUser = async (
-  user: User | ThirdPartyUser,
+  user: User,
   opts: SaveUserOpts = {
     hashPassword: true,
     requirePassword: true,
@@ -121,24 +130,31 @@ const buildUser = async (
   tenantId: string,
   dbUser?: any
 ): Promise<User> => {
-  let fullUser = user as User
-  let { password, _id } = fullUser
+  let { password, _id } = user
 
   let hashedPassword
   if (password) {
+    if (await isPreventPasswordActions(user)) {
+      throw new HTTPError("Password change is disabled for this user", 400)
+    }
     hashedPassword = opts.hashPassword ? await utils.hash(password) : password
   } else if (dbUser) {
     hashedPassword = dbUser.password
-  } else if (opts.requirePassword) {
+  }
+
+  // passwords are never required if sso is enforced
+  const requirePasswords =
+    opts.requirePassword && !(await pro.features.isSSOEnforced())
+  if (!hashedPassword && requirePasswords) {
     throw "Password must be specified."
   }
 
   _id = _id || dbUtils.generateGlobalUserID()
 
-  fullUser = {
+  const fullUser = {
     createdAt: Date.now(),
     ...dbUser,
-    ...fullUser,
+    ...user,
     _id,
     password: hashedPassword,
     tenantId,
@@ -189,10 +205,41 @@ const validateUniqueUser = async (email: string, tenantId: string) => {
   }
 }
 
+export async function isPreventPasswordActions(user: User) {
+  // when in maintenance mode we allow sso users with the admin role
+  // to perform any password action - this prevents lockout
+  if (coreEnv.ENABLE_SSO_MAINTENANCE_MODE && user.admin?.global) {
+    return false
+  }
+
+  // SSO is enforced for all users
+  if (await pro.features.isSSOEnforced()) {
+    return true
+  }
+
+  // Check local sso
+  if (isSSOUser(user)) {
+    return true
+  }
+
+  // Check account sso
+  const account = await accountSdk.api.getAccount(user.email)
+  return !!(account && isSSOAccount(account))
+}
+
+export async function updateSelf(id: string, data: UpdateSelf) {
+  let user = await getUser(id)
+  user = {
+    ...user,
+    ...data,
+  }
+  return save(user)
+}
+
 export const save = async (
-  user: User | ThirdPartyUser,
+  user: User,
   opts: SaveUserOpts = {}
-): Promise<CreateUserResponse> => {
+): Promise<User> => {
   // default booleans to true
   if (opts.hashPassword == null) {
     opts.hashPassword = true
@@ -203,7 +250,7 @@ export const save = async (
   const tenantId = tenancy.getTenantId()
   const db = tenancy.getGlobalDB()
 
-  let { email, _id, userGroups = [] } = user
+  let { email, _id, userGroups = [], roles } = user
 
   if (!email && !_id) {
     throw new Error("_id or email is required")
@@ -245,6 +292,10 @@ export const save = async (
     builtUser.roles = dbUser.roles
   }
 
+  if (!dbUser && roles?.length) {
+    builtUser.roles = { ...roles }
+  }
+
   // make sure we set the _id field for a new user
   // Also if this is a new user, associate groups with them
   let groupPromises = []
@@ -253,7 +304,7 @@ export const save = async (
 
     if (userGroups.length > 0) {
       for (let groupId of userGroups) {
-        groupPromises.push(groupsSdk.addUsers(groupId, [_id]))
+        groupPromises.push(pro.groups.addUsers(groupId, [_id]))
       }
     }
   }
@@ -264,7 +315,7 @@ export const save = async (
     builtUser._rev = response.rev
 
     await eventHelpers.handleSaveEvents(builtUser, dbUser)
-    await addTenant(tenantId, _id, email)
+    await platform.users.addUser(tenantId, builtUser._id!, builtUser.email)
     await cache.user.invalidateUser(response.id)
 
     // let server know to sync user
@@ -272,11 +323,8 @@ export const save = async (
 
     await Promise.all(groupPromises)
 
-    return {
-      _id: response.id,
-      _rev: response.rev,
-      email,
-    }
+    // finally returned the saved user from the db
+    return db.get(builtUser._id!)
   } catch (err: any) {
     if (err.status === 409) {
       throw "User exists already"
@@ -286,21 +334,6 @@ export const save = async (
   }
 }
 
-export const addTenant = async (
-  tenantId: string,
-  _id: string,
-  email: string
-) => {
-  if (env.MULTI_TENANCY) {
-    const afterCreateTenant = () =>
-      migrations.backPopulateMigrations({
-        type: MigrationType.GLOBAL,
-        tenantId,
-      })
-    await tenancy.tryAddTenant(tenantId, _id, email, afterCreateTenant)
-  }
-}
-
 const getExistingTenantUsers = async (emails: string[]): Promise<User[]> => {
   const lcEmails = emails.map(email => email.toLowerCase())
   const params = {
@@ -432,7 +465,7 @@ export const bulkCreate = async (
   for (const user of usersToBulkSave) {
     // TODO: Refactor to bulk insert users into the info db
     // instead of relying on looping tenant creation
-    await addTenant(tenantId, user._id, user.email)
+    await platform.users.addUser(tenantId, user._id, user.email)
     await eventHelpers.handleSaveEvents(user, undefined)
     await apps.syncUserInApps(user._id)
   }
@@ -449,7 +482,7 @@ export const bulkCreate = async (
     const groupPromises = []
     const createdUserIds = saved.map(user => user._id)
     for (let groupId of groups) {
-      groupPromises.push(groupsSdk.addUsers(groupId, createdUserIds))
+      groupPromises.push(pro.groups.addUsers(groupId, createdUserIds))
     }
     await Promise.all(groupPromises)
   }
@@ -550,7 +583,7 @@ export const bulkDelete = async (
 
 export const destroy = async (id: string, currentUser: any) => {
   const db = tenancy.getGlobalDB()
-  const dbUser = await db.get(id)
+  const dbUser = (await db.get(id)) as User
   const userId = dbUser._id as string
 
   if (!env.SELF_HOSTED && !env.DISABLE_ACCOUNT_PORTAL) {
@@ -566,7 +599,7 @@ export const destroy = async (id: string, currentUser: any) => {
     }
   }
 
-  await deprovisioning.removeUserFromInfoDB(dbUser)
+  await platform.users.removeUser(dbUser)
 
   await db.remove(userId, dbUser._rev)
 
@@ -579,7 +612,7 @@ export const destroy = async (id: string, currentUser: any) => {
 
 const bulkDeleteProcessing = async (dbUser: User) => {
   const userId = dbUser._id as string
-  await deprovisioning.removeUserFromInfoDB(dbUser)
+  await platform.users.removeUser(dbUser)
   await eventHelpers.handleDeleteEvents(dbUser)
   await cache.user.invalidateUser(userId)
   await sessions.invalidateSessions(userId, { reason: "bulk-deletion" })
@@ -624,7 +657,7 @@ export const invite = async (
       }
       await sendEmail(user.email, EmailTemplatePurpose.INVITATION, opts)
       response.successful.push({ email: user.email })
-      await events.user.invited()
+      await events.user.invited(user.email)
     } catch (e) {
       console.error(`Failed to send email invitation email=${user.email}`, e)
       response.unsuccessful.push({